Skip to main content
The site origin is https://marketplace.kineticvm.xyz. Browser flows use a session cookie after Google sign-in. The device uses a bearer key and does not use the cookie. Errors are JSON with an error string and an HTTP status. A successful JSON body is the object described on each route.

​
Issue an agent key

Sign in first. Then create a challenge and sign the message it returns.
The response is { "id", "message" }. message is:
Sign that text with the wallet (a personal signature). Post the challenge id and the signature:
On success, status 201, the body includes key, id, agentId, prefix, and device. key starts with kvm_ and is shown once. The route reads ownerOf. If the signer is not the owner, the status is 403. Keys whose wallet no longer holds the NFT are revoked as part of this call. GET /api/marketplace/keys lists the account’s keys and does not return the secrets.

​
List from a device

POST /api/agent/listings Header: Authorization: Bearer kvm_… Multipart fields: The manifest is version 1, chainId 10143, agentId matching the key, and rows of { "paramsHash", "requestHash" }. Each paramsHash must be keccak256 of the matching data line. At most 5,000 rows and 20 MB per file. Status 201:
The response has no CIDs. The device turns url into an absolute link on the marketplace origin. Before pinning, the route checks the key, re-reads ownerOf, and refuses the listing if that wallet no longer holds the agent. Attestations are checked by the verify route, not by this one.

​
Verify

POST /api/marketplace/listings/{slug}/verify No body. The route loads the pinned manifest and calls getValidationStatus for every row. A row must belong to the listing’s agent, name the Kinetic attestor as validator, have response 100, have responseHash equal to paramsHash, and use the tag kinetic-action when a tag is set.
rows is the first eight. preview: true means the slug is a sample listing and the rows were not read from Monad.

​
Purchase

POST /api/marketplace/listings/{slug}/purchase Session cookie required. JSON body: { "txHash": "0x…", "signature": "0x…" }. The signature is a personal signature over:
The transaction must be confirmed on Monad testnet, from the signer, to the listing’s payout address, and at least the listing price. A transaction hash can be used once. The response is { "access": { "dataCid", "manifestCid", "dataUrl", "manifestUrl" } }. Those URLs are also available to the signed-in owner of the listing, and to a buyer who already purchased, from: GET /api/marketplace/listings/{slug}/file?part=data GET /api/marketplace/listings/{slug}/file?part=manifest part is required. The response is the file as a download.